Cryptology ePrint Archive: Report 2021/1644

Pushing the Limits: Searching for Implementations with the Smallest Area for Lightweight S-Boxes

Zhenyu Lu and Weijia Wang and Kai Hu and Yanhong Fan and Lixuan Wu and Meiqin Wang

Abstract: The area is one of the most important criteria for an S-box in hardware implementation when designing lightweight cryptography primitives. The area can be well estimated by the number of gate equivalent (GE). However, to our best knowledge, there is no efficient method to search for an S-box implementation with the least GE. Previous approaches can be classified into two categories, one is a heuristic that aims at finding an implementation with a satisfying but not necessarily the smallest GE number; the other one is SAT-based focusing on only the smallest number of gates while it ignored that the areas of different gates vary. Implementation with the least gates would usually not lead to the smallest number of GE. In this paper, we propose an improved SAT-based tool targeting optimizing the number of GE of an S-box implementation. Given an S-box, our tool can return the implementation of this S-box with the smallest number of GE. We speed up the search process of the tool by bit-sliced technique. Additionally, our tool supports 2-, 3-, and 4-input gates, while the previous tools cover only 2-input gates. To highlight the strength of our tool, we apply it to some 4-bit and 5-bit S-boxes of famous ciphers. We obtain a better implementation of RECTANGLE's S-box with the area of 18.00GE. What's more, we prove that the implementations of S-boxes of PICCOLO, SKINNY, and LBLOCK in the current literature have been optimal. When using the DC synthesizer on the circuits produced by our tool, the area are much better than the circuits converted by DC synthesizers from the lookup tables (LUT). At last, we use our tool to find implementations of 5-bit S-boxes, such as those used in KECCAK and ASCON.

Category / Keywords: implementation / Lightweight ciphers, S-box implementations, Gate equivalent complexity, SAT-solvers

Original Publication (with minor differences): INDOCRYPT2021

Date: received 16 Dec 2021, last revised 23 Dec 2021

Contact author: luzhenyu at mail sdu edu cn

Available format(s): PDF | BibTeX Citation

Version: 20211223:133735 (All versions of this report)

Short URL:

[ Cryptology ePrint archive ]